Analysis
-
max time kernel
3617372s -
max time network
158s -
platform
android_x86 -
resource
android-x86-arm-20231215-en -
resource tags
-
submitted
31-12-2023 01:55
General
-
Target
23840a61dcaa176bf27eb79bcd9ba55f.apk
-
Size
3.2MB
-
MD5
23840a61dcaa176bf27eb79bcd9ba55f
-
SHA1
8a0b23ee64e462c310108a46adb22ef2f27f8c17
-
SHA256
c4a922a3eb4ba560f413d376f3f6944e9900457ee14b06656e369b207ec644fd
-
SHA512
cdc16f0ffaa13b84c640b34210d06d48b25b4cc297b843e7d4d2ef81043dbe87aa9f407917980d5d3fde0859fc5ce80e011286563010e9784828d1e9a3be3ef6
-
SSDEEP
98304:mowD2ikvgCi16rt5qiTwVDUaLbSPrXYKXM2JU6r3W3i:mowSz5fncVDpsM2JP3N
Malware Config
Signatures
-
Hydra
Android banker and info stealer.
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Reads information about phone network operator.
Processes
-
com.jzvsgzfv.rygpynw1⤵
- Makes use of the framework's Accessibility service
- Loads dropped Dex/Jar
-
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.jzvsgzfv.rygpynw/code_cache/secondary-dexes/base.apk.classes1.zip --output-vdex-fd=44 --oat-fd=45 --oat-location=/data/user/0/com.jzvsgzfv.rygpynw/code_cache/secondary-dexes/oat/x86/base.apk.classes1.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5cff004c8a43825b12ef8a844bb66ac03
SHA1a27e8efccc733f98a6ecad33f240f7d588a09f01
SHA2561fab60723b58c1ca9e793247b8b18000d50acbfbbc45347835ae3e497eb67ed9
SHA512bce335ae4f0f443f1f1f9856e4d48b497b87814efff4966761cdc15466b03bffe0416a3b29fcd139ee5070e86b8efeeb107d0e2204d5358bca085a347b61659c
-
Filesize
902KB
MD5371b8789b9d740050149af418bd4344f
SHA1cc12992b5aa467735b7b4f9c63cd7fca1b465891
SHA256400bfd101cba6b3996771d8a889576332288858bc31f6a77b0fd078823752f1f
SHA512040706b6cd92c947b004f1373e8600eee79a508da512f7f5206db6daf0d90d95d6f30b2e93e6e3ff02502fc0a2f0ea5043abe9502230dae718ea23ac82abdd18
-
Filesize
902KB
MD52ec93f0bdcfe7658ae7cff670827bbcd
SHA190ce910e1d9610d49d69eef55c757b8bd198b637
SHA2566feb516e56ba37446e40b9bdebc87574dcd80f2f907caa8bec3992d3485b8aee
SHA512f33d019a799f74e13ba84868cf72d21e3d0bacc91d4dfc10e3a415f36829c536d7062e2861437916024cbf271f370eab5f61373f3863c8359d7526fad902efee